Solutions
Four instruments are mapped. The rest say so.
A clause map is data, so the engine scores any instrument somebody encodes. Four ship today. Every other page here states plainly that no map exists and what the platform contributes anyway — because a readiness percentage against an instrument nobody encoded is a number with no denominator.
Instruments we map clause by clause
EU AI Act
Regulation (EU) 2024/1689. Fourteen clauses mapped, scored only over the obligations that currently apply, with the ones deferred to December 2027 stated beside the number rather than fol...
clause map →GDPR
Regulation (EU) 2016/679. Eleven clauses mapped, including Art. 32(1)(d) — regularly testing the effectiveness of technical measures — which is the one almost nothing evidences because it...
clause map →NIST AI RMF
AI Risk Management Framework 1.0. Voluntary, which is exactly why the evidence matters: nobody is compelled to produce it, so producing it is a signal.
clause map →SR 11-7
Supervisory Guidance on Model Risk Management. Written in 2011 for models that produce numbers, and now read against systems that take actions — which is where the inventory question gets...
clause map →Frameworks and guidance we do not map
Two different reasons sit in this list, and collapsing them would be the kind of thing this platform exists to catch. MAS FEAT and the UK approach have nothing to enumerate — one asks a firm to define its own objective, the other has no statute. DORA and ISO 42001 have numbered articles and controls, and are unmapped because we have not written the maps yet. Each page says which of the two it is, in those words.
Canada AIDA
The Artificial Intelligence and Data Act was part of Bill C-27, which died on the Order Paper when Parliament was prorogued in January 2025. It is not law, and a page implying otherwise w...
read →DORA
Regulation (EU) 2022/2554. Not an AI regulation — an operational resilience one — in force since January 2025. RotaGrant touches two of its five pillars, which is an argument for mapping ...
read →ISO/IEC 42001
The AI management system standard. Certifiable, which makes it the one buyers ask about most and the one where vendor claims are loosest — because a management system is a set of organisa...
read →MAS FEAT
Fairness, Ethics, Accountability and Transparency. Principles-based by design — a firm defines and justifies its own fairness objective — which is why RotaGrant's Singapore profile select...
read →UK AI framework
The pro-innovation approach delegates AI to existing regulators — the FCA, the ICO, the MHRA — rather than creating a cross-cutting statute. So there is no instrument to map, and the bind...
read →By sector
Financial services
The sector where an agent's actions move money, where three supervisors can have a view of the same workload, and where the question after an incident is not what the model scored but who...
read →Government
The sector that asks the outbound question first and does not accept a policy statement as the answer. Airgapped mode refuses to start if any setting selects a service outside your networ...
read →Healthcare
An earlier version of this website said Rotascale maintained HIPAA and FDA compliance. Neither was true. This page exists partly to correct that in the open, because a governance vendor t...
read →Insurance
Claims is where multi-agent pipelines arrive first and where delegation gets dangerous quietly: an orchestrator hands work to a specialist, the specialist hands work onward, and nobody is...
read →Telecommunications
Customer operations at volume, across markets, where the same workflow runs under several regimes and the retention window is set by whichever one applies to that subscriber.
read →An instrument we do not map is not an instrument we dismiss. Clause maps are YAML validated against the evidence registry at load, so a regulatory analyst can author one without a release. What we will not do is ship a page implying a mapping exists in order to appear in a search result.